問題文
A team has one dependable way of working out which hosts carry a given piece of foreign code, and it plans to lean on that one way when a large incident arrives. What does the guidance say about a plan of that shape?
選択肢
- Hand the work to the product that raised the alert, because the count of hosts is a by product of the detection rather than a task of its own.
- Wait for the incident and choose the way that suits it, because the shape of the code governs which way of working out the hosts will bear fruit.
- Hold to the one dependable way and record the others as a reserve, because a single way applied consistently gives a count that can be compared over time.
- Work out several ways beforehand then build the means to run them, because the shifting nature of the code and of the estate leaves one way short of the mark.